Conditional Access, MSP evidence, Claude ladder

• Six-level framework, amateur to agent orchestrator — amateur (one-shot chat), regular (Projects with a master prompt), integrator (connectors: Gmail/Drive/Slack/Notion), operator (system prompts + skills + scheduled tasks), builder (Claude Code: loops/disposable tools/real apps), agent orchestrator (a main agent directing specialised sub-agents).
• "Master prompt" via interview — tells Claude "interview me to build a master prompt for my role," turning the transcript into a persistent role-context file added to a Project.
• ! "Cowork" — real Anthropic product, not invented — a desktop app tab that runs scheduled, autonomous multi-step tasks in the background; launched Jan 2026, GA on paid plans mid-2026. He undersells it as "an app that runs on your computer" without naming what it actually is.
• Claude Code Remote Control — directing a running coding session from a phone; real feature (Feb 2026), matches his description (/remote / /rc-style handoff, local execution, phone just drives it).
• Plan mode before building — /plan, dump the idea, Claude asks clarifying questions, writes a plan you approve before any code — his stated reason for lower AI spend (approve the plan, not the false starts) matches how the feature is documented to work.
• Agent chaining — a copywriting skill and an email skill both called by a third, inbox-automation skill; skills as composable units is consistent with how Anthropic documents the feature, though "hundreds" of pre-built skills is his number, not independently checked.

Worth your time if: you use Claude daily and haven't touched Projects, connectors, or Claude Code — this is a fast map of what's above "just chatting." Skip if: you're already running scheduled agents and chained skills — this is a beginner-to-intermediate ladder, not new ground past level 4.

Make Claude interview you to build a master prompt, then put it in a Project alongside a handful of real reference files (his example: voice document, branding document, past scripts). Cheapest of the six levels to try, and it's the one that compounds — every level above it (operator's system prompts, builder's plan mode) is the same "let Claude ask, then persist the answer" pattern applied to a bigger surface.

Doesn't name Cowork by its actual product name anywhere in the video — calls it just "an app that runs on your computer" — which makes it sound like a third-party tool or something he built, when it's a first-party Anthropic feature. Not wrong, just under-labelled; worth knowing the actual name if you want to go try it. Otherwise nothing contradicted — every specific, checkable claim in this one held up, which is the opposite of the other two Martell videos scored this run (both rejected for exhortation with nothing to check).

Try the master-prompt-via-interview move in your next Claude session on something you do repeatedly — that's the cheapest level-2 move and it's the one his whole ladder builds on. If Cowork is genuinely useful for The Rundown's own scheduled-task pattern, that's worth a separate look outside this brief — it's Anthropic's answer to exactly the "runs on a schedule while you're not there" shape this tool already uses, just via the desktop app rather than claude -p.

Read the full 3,154-word auto-caption transcript. Did not check the "hundreds of pre-built skills" count or verify skill-chaining specifics beyond the general feature's documented existence. Caption quality clean (211 wpm, no obvious mangling — fast talker, not garbled). Confidence the two most check-worthy claims (Cowork, Remote Control) are accurate: 0.85, both independently confirmed against Anthropic's own docs/blog. Confidence in the overall six-level framework as a useful, non-hyped map of Claude's feature surface: 0.75.

• Trusted-location MFA bypass — demo tenant has 14 "trusted" IPs skipping MFA entirely: a caravan, a golf club, a McDonald's, "Kevin's mum's house."
• Guest Wi-Fi shares the corporate public IP — if guest and corporate networks exit through the same public IP, a stolen password on the guest network satisfies the trusted-location condition and never triggers MFA. His reasoning, not a documented Microsoft claim — see Verification.
• ! Breaks Microsoft's own Zero Trust principle — "verify explicitly" means checking the device, not the network; location-based MFA bypass is exactly what the principle argues against, confirmed verbatim against Microsoft Learn.
• Fix: require compliant device, not location — Conditional Access checks Intune compliance state instead of IP range; this is Microsoft's own documented alternative pattern, not an opinion.
• Screen demo included — walks a real Entra CA policy: all users, break-glass excluded, all resources, "require device marked as compliant," zero location conditions.

Worth your time if: a client (or your own tenant) still excludes MFA for a "trusted" office IP range — the fix is a same-day Conditional Access change. Skip if: you already run compliant-device-only policies with no location-based MFA exclusion.

This is a real, correctly-described Zero Trust control, not a hook dressed up as one. The "verify explicitly" framing and the trusted-locations-for-MFA-bypass risk both match Microsoft Learn's own wording closely enough to look drawn from it. The compliant-device policy he demos is Microsoft's documented alternative, built the same way Learn's own walkthrough builds it (all users, break-glass exclusion, all resources, require compliant device, no location condition). Already covered by Quontiant's CA-POLICY-001 (trusted-location bypass, device compliance) and CA-NAMED-LOCATIONS-001 — no new check candidate, this is commodity ground Quontiant already stands on.

Nothing contradicted. One thing worth being precise about with a client: he does say trusted locations are "generally useful" outside MFA bypass (Identity Protection false-positive reduction), so there's no risk of a client over-correcting by ripping out named locations entirely — he heads that off himself, just briefly enough to miss on a first watch.

Commodity — already built. CA-POLICY-001 covers trusted-location bypass and device-compliance requirements directly; CA-NAMED-LOCATIONS-001 covers the named-locations configuration itself. Checked against node scripts/ops/claims-index.mjs --compact IDENTITY in D:\QuontiantV3 before writing this — no new candidate queued.

Nothing new to build. If you want the marketing angle: this is the same evidence-over-claims argument as the other Jonathan Edwards brief this run (losing MSP deals to cheaper competitors) — Quontiant's CA-POLICY-001 output is exactly the kind of number ("MFA coverage: 100% of accounts, zero location-based bypass") that video says belongs in the proposal, not a portal.

Read the full 865-word auto-caption transcript. Did not open the linked course page or watch the screen-demo section frame by frame — the demo narration (policy name, scope, grant control) is taken from the transcript, not verified against a paused frame. Auto-captions are clean here (143 wpm, no obvious mangling). Confidence the mechanism and Zero Trust framing are accurately described: 0.85 (both independently confirmed against Learn). Confidence in the unverified guest-Wi-Fi claim: 0.5 — sound reasoning, no source to check.

• The real reason MSPs lose to cheaper quotes — not price, but that "24/7 monitoring," "proactive support," "security-first" are unverifiable and identical across every competitor's brochure, so price becomes the only thing left to compare.
• Move 1: replace promises with numbers — patch compliance %, MFA coverage %, backup-restore test pass/fail with a date, instead of adjectives.
• Move 2: put the evidence where the decision happens — in the proposal and the QBR, not a client portal logged into once in 2019.
• Move 3: get something you didn't mark yourself — third-party verification closes the "marking your own homework" gap.
• ! Certification ladder: Cyber Essentials Plus is the floor, ISO 27001 is the differentiator — CE Plus as UK entry ticket, ISO 27001 as the rare credential that actually separates an MSP from the field.

Worth your time if: you (or Quontiant's MSP customers) are losing deals on price and can't articulate why. Skip if: you already lead every proposal with hard numbers, not claims.

There's no factual claim here to fact-check against an external source — it's a sales framework, delivered as a two-hander skit (Jonathan correcting "Mike"). The mechanism holds up on its own logic: unverifiable claims really do converge to price as the only comparable signal, and the fix — quantify, place the evidence in the moment of decision, get third-party sign-off — is standard, sound sales advice specific to a technical service nobody can audit themselves. The one checkable factual claim in it (Cyber Essentials Plus vs ISO 27001) holds up against independent sources.

Nothing contradicted. It's an opinion piece dressed as a two-hander skit, and it says so implicitly — there's no claim here dressed up as a fact that isn't one, which is itself worth noting after two Martell videos this run that do the opposite.

Not a check candidate — this is a positioning insight, not a control. But it's directly useful for Quontiant's own go-to-market: the video's argument ("replace promises with numbers, put evidence where the decision happens") is exactly what a Quontiant check report is for — an MSP's client-facing evidence that isn't the MSP marking its own homework. Worth feeding into [[project-quontiant-competitive]] positioning work as a customer-facing argument for why Quontiant reports belong in the proposal, not a portal. Not queuing this in check-candidates.md — that file is for technical controls with an authoritative source to test against, and this has neither.

If Quontiant's sales messaging to MSPs doesn't already lead with "put this number in your next QBR," this video is a two-minute rewrite of that pitch. Flagged for wise-council/GTM review, not built — that's a positioning call, not a code change.

Read the full 743-word auto-caption transcript. Did not check MSP certification-rate statistics beyond the general cost/scope comparison above. Caption quality clean (141 wpm, no obvious mangling). Confidence the CE Plus/ISO 27001 comparison is accurately represented: 0.8. Confidence the underlying sales mechanism (unverifiable claims → price competition) is sound general advice rather than something specific to verify: 0.7 — it's a reasoned argument, not a factual claim, so "verification" here means "does the logic hold," not "does a source confirm it."